The 42 CFR Part 2 Final Rule (2024) and Reproductive Health
The Confidentiality of Substance Use Disorder Patient Records Rule (42 CFR Part 2) protects substance use disorder treatment records and is generally more protective than HIPAA. The 2024 Final Rule (HHS, February 8, 2024) aligns Part 2 with HIPAA/HITECH, while a separate 2024 reproductive-health Privacy Rule was vacated nationwide in June 2025.
The Confidentiality of Substance Use Disorder Patient Records Rule (42 CFR Part 2) protects records of patients seeking treatment for alcohol or substance use at federally assisted programs. It is generally more protective than HIPAA and can be superseded by stricter state law.
The 2024 Final Rule (HHS, February 8, 2024) allows a single patient consent for all future uses and disclosures for treatment, payment, and health care operations (TPO); lets HIPAA-covered recipients redisclose per HIPAA; replaces Part 2's criminal penalties with the civil and criminal enforcement that applies to HIPAA; applies the HIPAA Breach Notification Rule to Part 2 breaches; and adds a safe harbor for investigative agencies.
In 2024 HHS OCR finalized a Privacy Rule barring disclosure of PHI for obtaining lawful reproductive health care in certain circumstances. But in June 2025 a Texas federal judge vacated that rule nationwide, and HHS is determining next steps.